Pith. sign in

REVIEW 3 major objections 5 minor 52 references

Precise, Fast, and Low-cost Concept Erasure in Value Space: Orthogonal Complement Matters

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A single projection erases a concept from a diffusion model with no retraining.

desk verdict A solid, training-free value-space projection for concept erasure that mostly works on literal token concepts, with an honest failure case when the concept is spread across other tokens. read the letter →

arxiv 2412.06143 v2 pith:EFCDV2AP submitted 2024-12-09 cs.CV cs.AI

Yuan Wang , Ouxiang Li , Tingting Mu , Yanbin Hao , Kuien Liu , Xiang Wang , Xiangnan He This is my paper · ORCID
classification cs.CVcs.AI
keywords concepterasuretraining-freemethodorthogonalcomplementcross-attentionvaluespacediffusionmodelspriorpreservationmulti-conceptadaptiveshiftfactor
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes AdaVD, a training-free method for erasing unwanted concepts such as instances, art styles, celebrities, or NSFW content from text-to-image diffusion models. Its central claim is that a target concept can be removed by projecting the value vectors in each cross-attention layer onto the orthogonal complement of the target concept's own value vector, with a sigmoid-based shift factor that softens the erasure for weakly related tokens. The claim matters because existing training-free methods either erase too much, damaging non-target content, or too little, leaving the target visible, while training-based methods require costly fine-tuning per concept. AdaVD reports the best or near-best erasure efficacy together with 2 to 10 times better prior preservation than the second-best baseline across single- and multi-concept settings.

What carries the argument

The central object is the orthogonal-complement projection in cross-attention value space, $P_{\mathrm{span}^\perp(v_t^j)} v^j = v^j - \frac{v_t^{j\top} v^j}{v_t^{j\top} v_t^j} v_t^j$, applied token-wise in every cross-attention layer of the denoising UNet. This is paired with an adaptive erasing shift $\delta(x,y) = \frac{s}{1 + e^{-p(\cos(x,y)-\epsilon)}}$ with $0<\epsilon<1$, $s>0$, $p>0$, which dampens erasure when the prompt token's value vector is only weakly or generally related to the target. Token-wise target preprocessing duplicates the last subject token of the concept across all non-[SOT] positions, exploiting the causal CLIP text encoder so that one vector summarizes the whole target phrase. For multiple concepts, Gram-Schmidt orthogonalization produces a basis of the joint span and the projection subtracts each basis component, shifted per target. The mechanism works through the attention-matrix output: replacing V before the softmax-weighted aggregation redirects generation away from target semantics without altering the layout-controlling keys.

What would settle it

Regenerate "a photo of a teddy bear and a Snoopy doll" with the same seed before and after erasing "Snoopy", then compare the teddy-bear region with a detector or pixel distance: if the non-target object's pose or appearance changes noticeably, the projection is removing components beyond the target direction, contradicting the claimed prior preservation.

Watch

Extended reading notes

Core claim

AdaVD erases concept semantics directly in the value space of the UNet's cross-attention layers, on the view that values carry the "what" of generated content. For each token position j, the prompt's value vector $v_j$ is replaced by $v_j^r = v_j - \delta(v_t^j, v_j) \, \frac{v_t^{j\top} v_j}{v_t^{j\top} v_t^j} \, v_t^j$, where $v_t^j$ comes from a target embedding whose tokens are all replaced by the duplicated last subject token of the target concept and the [SOT] position is left untouched. The shift factor $\delta$ is a sigmoid of the cosine similarity between prompt and target value vectors, so strongly aligned tokens are erased while weak or general alignments are retained. Multi-concept erasure projects onto the orthogonal complement of the span of all target value vectors, using Gram-Schmidt orthogonalization. Applied layer-by-layer, this is reported to remove the target with minimal change to non-target priors, and to transfer to SDXL, SDv3, and community diffusion models with no retraining.

Load-bearing premise

The load-bearing premise is that a target concept is faithfully represented by the value vector of its duplicated last-subject token, and that prompt semantics decompose linearly enough that removing that one direction leaves non-target content intact; the paper's own failure case of "Van Gogh" coupled with "Starry Night" shows this premise does not always hold.

Editorial extensions

If this is right

  • New concepts can be erased at inference time in tens of seconds, with no per-concept fine-tuning, making real-time moderation of emerging unsafe or copyrighted content practical.
  • Erasing several concepts together does not degrade into catastrophic forgetting: the paper demonstrates consistent erasure and prior preservation when the target set grows to 40 concepts.
  • The same value-space projection transfers across model families, including SDXL, SDv3, and community fine-tunes, without changing the erasure procedure.
  • The operation doubles as an editing primitive: implicit concepts such as rainy or foggy, appearance attributes such as glasses or mustache, and coupled color attributes such as red on apples and roses can be suppressed by the same projection.
  • NSFW erasure is handled through the same mechanism, with roughly 85% of detected nude items removed on the I2P benchmark while non-target content stays close to the original.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the value-space disentanglement is as clean as reported, attention-map editing could be reformulated as value projection, offering a unified algebra for concept editing, style transfer, and attribute suppression.
  • The failure case of "Van Gogh" with "Starry Night" suggests the single-direction assumption breaks when a target is entangled with another multi-token phrase; a natural extension is to erase along the principal component of the span of all coupled tokens rather than the duplicated last-subject token alone.
  • The paper leaves the layer-wise accumulation unanalyzed; a testable prediction is that applying the projection only in early or only in late cross-attention layers produces measurably different trade-offs between erasure and prior preservation.
  • Because the shift factor thresholds on cosine similarity, per-layer or per-timestep epsilon schedules could reduce the small pixel drift that accumulates as the number of erased concepts grows.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes AdaVD, a training-free concept-erasure method for text-to-image diffusion models. The method pre-processes a target-concept prompt by duplicating the last subject token, computes the value matrix of this modified embedding in each cross-attention layer, and projects the prompt's value vectors onto the orthogonal complement of the target value vectors (Eqs. 2 and 3). A sigmoid shift factor (Eq. 6) modulates the projection strength token-wise. The authors evaluate single- and multi-concept erasure of instances, art styles, celebrities, and NSFW content on SD v1.4 and several other model versions, reporting strong erasure efficacy and 2 to 10 times FID improvement over baselines.

Significance. If the central claims hold, the method is practically valuable: it is training-free, simple, fast, and appears to transfer to SDXL, SDv3, and community SD models. The orthogonal-complement derivation is standard and clearly presented, and the experiments cover a wide range of concepts and baselines, including a concurrent orthogonal-decomposition method. The main risk is that the strong prior-preservation numbers are substantially produced by the conservative cosine threshold rather than by genuine semantic disentanglement, and Appendix H shows that the token-duplication premise breaks when the target concept is expressed through multiple coupled tokens. With those points addressed, the method would be a solid contribution.

major comments (3)
  1. [Sec. 3.2, Eq. (1), and Appendix H] The method's central premise is that the target concept is concentrated in the duplicated last-subject token's value vector and that projecting against this vector erases the concept. Appendix H directly contradicts this for 'Van Gogh' in the prompt 'The Starry Night is an iconic example of a masterpiece created in Van Gogh style': the default setting s=2 fails because other tokens such as 'Starry Night' are highly coupled with the target. This means the method erases the literal duplicated token, not the concept in general, unless the user manually adds additional target tokens or raises s. The abstract and introduction claim concept-level erasure; the paper should either qualify the claim to token-localized erasure or incorporate the Appendix H remedy automatically.
  2. [Sec. 3.4, Eq. (6), and Appendix C.2] The shift factor with epsilon=0.93 effectively disables erasure for any token pair whose cosine similarity is below 0.93; for the reported non-target concept 'Mickey' versus the target 'Snoopy', the cosine is 0.65, giving a shift factor of about 0.002, so no modification occurs by construction. The 2-10x FID improvement over baselines on non-target prompts is therefore partly a consequence of the hand-set threshold rather than evidence that the orthogonal complement separates target and non-target semantics in value space. To support the disentangling claim, the authors should ablate epsilon, for example by reporting FID and erasure CLIP scores at a matched erasure strength, and should show that low FID persists when erasure is actually applied to the non-target tokens.
  3. [Sec. 4.1 and Tables 1-6] All quantitative comparisons use 10 images per template and a single seed, and no error bars or significance tests are reported. Many of the claimed advantages are large, but some close comparisons, such as Table 2 'Erase Van Gogh' target CS (SPM 24.78 versus Ours 24.87), would be more convincing with confidence intervals or multiple seeds. Because prior-preservation FID is the paper's headline claim, the absence of variance estimates is a load-bearing gap in the empirical support.
minor comments (5)
  1. [Sec. 1, contribution bullet] The fourth contribution bullet contains a typo: 'AdaV A' should be 'AdaVD'.
  2. [Sec. 4.2] The text states that AdaVD's FID is 33% lower than the second-best method, but from Table 1, for 'Dog' after erasing 'Snoopy', Ours is 2.32 versus SPM's 19.61, which is about 88% lower; please verify the stated percentage or specify which comparison is intended.
  3. [Appendix C.2] The hyperparameter analysis is qualitative only; reporting the corresponding CS and FID values for the settings shown in Fig. 8 would make it more informative and would strengthen the claim that the chosen default hyperparameters are robust.
  4. [Tables 4-6] The gray columns are said not to directly reflect erasure efficacy or prior preservation; consider moving them to a supplement or explaining their role more explicitly in the captions to avoid confusion.
  5. [Fig. 8 and Sec. 3.4] Because the threshold behavior is central to the method, Figure 8 would benefit from explicitly listing the cosine similarities for the analyzed target/non-target token pairs.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: AdaVD's value-space orthogonal-complement projection is an empirical intervention with fixed hyperparameters; the only self-citations are background, and the Appendix H failure is a robustness limitation, not a circular derivation.

full rationale

AdaVD's derivation chain is not circular. The erasing operation in Eqs. (2) and (4) explicitly projects each prompt token's value vector onto the orthogonal complement of the target token's value vector, scaled by a sigmoid shift factor; the target direction comes from the duplicated last-subject token in Eq. (1). No parameter is fitted to the reported metrics: Appendix C.1 fixes 'p = 100, ε = 0.93, and s = 2' as a unified configuration, and Appendix C.2 analyzes the resulting trade-off as hyperparameter behavior rather than as a learned prediction. Erasure efficacy and prior preservation are evaluated with external CLIP and FID metrics against generation outputs, not read off from the erased value vectors by construction. The load-bearing premises—values as the 'What' pathway [45], angular information as semantically critical [32], and the last subject token containing key information [28]—are cited from external prior work, not from the authors' own papers. The only self-citations ([22], [23]) appear in the introduction as examples of copyright/offensiveness concerns and are not load-bearing. Appendix H is an honest limitation: 'the challenge is likely to stem from the presence of multiple tokens, e.g., Starry Night, that is highly coupled with the target concept,' and the fix is to increase s or add related target tokens. This shows the duplicated-token premise is empirically contingent and sometimes fails, which is a correctness/robustness concern, not evidence that the method's output is equivalent to its input. The claim that prior preservation improves 2-10x is also a designed consequence of the high cosine threshold (δ≈0 for low-cosine tokens), but the FID numbers are non-zero and are measured against external baselines, so this is intended behavior rather than tautology. I therefore find no significant circularity and assign score 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

No new entities are posited. The method relies on three hand-set hyperparameters and four unproven semantic-linearization assumptions about CLIP token embeddings and UNet cross-attention values.

free parameters (3)
  • epsilon (cosine threshold) = 0.93
    Threshold in the sigmoid shift factor; set manually after sensitivity analysis in Appendix C.2. It directly controls how many non-target tokens are preserved.
  • s (scale) = 2
    Scales the shift factor magnitude; chosen by hand to balance erasure efficacy and prior preservation.
  • p (steepness) = 100
    Controls how quickly the shift factor rises with cosine similarity; sensitivity analysis shows it is less influential but still tuned.
assumptions (4)
  • domain assumption Cross-attention value vectors control visual content (the 'what' pathway), while keys control layout.
    Invoked in Section 3.1 citing [45]; justifies editing values rather than keys, but no direct validation is given in this paper.
  • domain assumption The last subject token of a CLIP-encoded concept embedding captures sufficient concept information.
    Used in Section 3.2 to duplicate the last subject token across all token positions; justified by causal attention in CLIP and cited [28], but not independently tested for all concepts.
  • domain assumption Value vectors of different target concepts are linearly independent.
    Stated in Section 3.3.2; needed for Gram-Schmidt orthogonalization and basis transformation. Reasonable for distinct concepts but not guaranteed for synonyms or overlapping styles.
  • domain assumption Angular (cosine) similarity between value vectors reflects semantic relevance.
    Basis for the sigmoid shift in Section 3.4, cited from [32]; no theoretical proof is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Precise, Fast, and Low-cost Concept Erasure in Value Space: Orthogonal Complement Matters." pith.science (2026). https://pith.science/paper/EFCDV2AP

@misc{pith2026241206143,
  author       = {Pith},
  title        = {Pith review of: Precise, Fast, and Low-cost Concept Erasure in Value Space: Orthogonal Complement Matters},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EFCDV2AP}},
  note         = {Machine review of arXiv:2412.06143}
}
read the original abstract

Recent success of text-to-image (T2I) generation and its increasing practical applications, enabled by diffusion models, require urgent consideration of erasing unwanted concepts, e.g., copyrighted, offensive, and unsafe ones, from the pre-trained models in a precise, timely, and low-cost manner. The twofold demand of concept erasure includes not only a precise removal of the target concept (i.e., erasure efficacy) but also a minimal change on non-target content (i.e., prior preservation), during generation. Existing methods face challenges in maintaining an effective balance between erasure efficacy and prior preservation, and they can be computationally costly. To improve, we propose a precise, fast, and low-cost concept erasure method, called Adaptive Value Decomposer (AdaVD), which is training-free. Our method is grounded in a classical linear algebraic operation of computing the orthogonal complement, implemented in the value space of each cross-attention layer within the UNet of diffusion models. We design a shift factor to adaptively navigate the erasure strength, enhancing effective prior preservation without sacrificing erasure efficacy. Extensive comparative experiments with both training-based and training-free state-of-the-art methods demonstrate that the proposed AdaVD excels in both single and multiple concept erasure, showing 2 to 10 times improvement in prior preservation than the second best, meanwhile achieving the best or near best erasure efficacy. AdaVD supports a series of diffusion models and downstream image generation tasks, with code available on: https://github.com/WYuan1001/AdaVD.

Figures

Figures reproduced from arXiv: 2412.06143 by the authors.

Figure 1
Figure 1. The proposed Adaptive Value Decomposer (AdaVD) demonstrates a satisfactory balance between erasure efficacy and prior [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of our Adaptive Value Decomposer (AdaVD) in erasing the target concept “Snoopy”. (a) First, we token-wisely duplicate the last subject token of the target embedding encoded by the text encoder, except for [SOT]. (b) Then, the pre-processed target embedding and corresponding prompt embedding are jointly fed into CA layers within the UNet as conditions, to disentangle target semantics from the original image … view at source ↗
Figure 3
Figure 3. We analyze the contribution of different tokens in text [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (15 more)
Figure 4
Figure 4. Figure 4: Qualitative comparison of single- and multi-instance erasure. Both training-based and training-free methods show limitations in prior preservation. In contrast, our AdaVD demonstrates considerable performance in maintaining prior knowledge without compromis￾ing erasure…
Figure 5
Figure 5. Figure 5: Qualitative comparison of art style erasure. Our AdaVD can effectively remove the target concept “Van Gogh” while preserving non-target styles like “Picasso” and “Monet”. consistently perform well for multi-concept erasure. For example, when erasing “Snoopy” and “Micke…
Figure 6
Figure 6. Figure 6: Visualization of erased components. In each block, we compare both target (1st row) and non-target concept (2nd row) by visualizing the original image (1st column), erased component (2nd column), and generation by our AdaVD (3rd colum). DreamShaper RealisticVision SD v…
Figure 7
Figure 7. Figure 7: Downstream applications. We extend AdaVD to ver￾satile generation tasks, including (1) implicit concept erasure, (2) image editing, and (3) attribute suppression, indicating its signifi￾cant potential for broad applications. cept erasure: by removing the implicit conce…
Figure 8
Figure 8. Figure 8: Impact of hyperparameter settings on erasure efficacy and prior preservation. To evaluate how hyperparameters affect this balance, we visualize images generated by AdaVD under various hyperparameter settings for the target concept “Snoopy” and the related but non-targe…
Figure 9
Figure 9. Figure 9: Qualitative comparison of celebrity erasure. Our AdaVD can effectively remove the target concept “Marilyn Monroe” while preserving non-target celebrities like “Bruce Lee” and “Melania Trump”. generated images from the prompt corresponding to “Melania Trump”. For instan…
Figure 10
Figure 10. Figure 10: Performance of AdaVD on NSFW erasure. The number following each category represents the number of nude items generated by SD v1.4, while each bar illustrates the success rate of erasing the corresponding nude items for each method. Our AdaVD demonstrates superior perf…
Figure 11
Figure 11. Figure 11: Extended results of AdaVD in single-concept erasure task. We present additional generated images after applying AdaVD with SD v1.4 to erase a single concept, further validating the erasure efficacy of our AdaVD. Liberty” and “Grumpy Cat” represent realistic entities f…
Figure 12
Figure 12. Figure 12: Results of AdaVD on SDXL v1.0 for erasing “Snoopy”: Our AdaVD effectively supports SDXL v1.0, which has a different structural design than SD v1.4, in achieving effective erasure of the target concept. Additionally, AdaVD demonstrates excellent prior preservation, as …
Figure 13
Figure 13. Figure 13: Results of AdaVD on SDv3 for erasing “Snoopy”: The images with red and blue borders represent the before and after concept erasure, respectively. Our AdaVD effectively enables SDv3 to erase the target concept “Snoopy” while preserving other semantic elements in the ge…
Figure 14
Figure 14. Figure 14: Results of AdaVD on other SD versions. Our AdaVD illustrates a high performance of both erasure efficacy and the prior preservation across SD with difference versions and easing different concepts. E.3. AdaVD on Community SD Versions We also couple AdaVD with several …
Figure 15
Figure 15. Figure 15: Qualitative comparison between SuppressEOT and AdaVD. We compare our AdaVD with SuppressEOT in single instance concept and art style erasure, demonstrating that AdaVD achieves more precise and effective erasure. concept while preserving the integrity of the non-target…
Figure 16
Figure 16. Figure 16: Examples of generated images for multi-concept erasure. The illustrated examples show a consistently high performance of AdaVD in both erasure efficacy and prior preservation as the number of erased concepts increases, as compared to SLD. detoxified embedding by Fouri…
Figure 17
Figure 17. Figure 17: Results of AdaVD on multi-concept erasure across different SD versions. We assess the performance of AdaVD on multi￾concept erasure across various community versions of SD under diverse erasure scenarios, including cross-application erasure as outlined in SPM [27] and…
Figure 18
Figure 18. Figure 18: Failure case when erasing “Van Gogh” and its solution. H. Failure Case Study Despite its success, there exist concepts that AdaVD struggles to erase. We present a few failure cases in [PITH_FULL_IMAGE:figures/full_fig_p023_18.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

52 extracted references · 27 canonical work pages

  1. [1]

    https : / / huggingface.co/CompVis/stable-diffusion- safety-checker, 2022

    Safety checker nested in stable diffusion. https : / / huggingface.co/CompVis/stable-diffusion- safety-checker, 2022. 3

    work page 2022

  2. [2]

    https : / / huggingface

    Stable diffusion. https : / / huggingface . co / CompVis/stable-diffusion-v1-4 , 2022. 2, 3, 6

    work page 2022

  3. [3]

    https://huggingface.co/ stabilityai/stable-diffusion-2, 2022

    Stable diffusion v2.0. https://huggingface.co/ stabilityai/stable-diffusion-2, 2022. 2

    work page 2022

  4. [4]

    https://huggingface.co/ stabilityai/stable-diffusion-2-1 , 2022

    Stable diffusion v2.1. https://huggingface.co/ stabilityai/stable-diffusion-2-1 , 2022. 8

    work page 2022

  5. [5]

    https : / / huggingface

    Chilloutmix. https : / / huggingface . co / swl - models/chilloutmix, 2023. 1, 8, 19

    work page 2023

  6. [6]

    https://huggingface.co/Lykon/ DreamShaper, 2023

    Dreamshaper. https://huggingface.co/Lykon/ DreamShaper, 2023. 1, 8, 19, 22

    work page 2023

  7. [7]

    https : / / huggingface

    Realisticvsion. https : / / huggingface . co / SG161222 / Realistic _ Vision _ V5 . 1 _ noVAE ,

    work page

  8. [8]

    Nudenet: Neural nets for nudity detec- tion and censoring, 2022

    Praneeth Bedapudi. Nudenet: Neural nets for nudity detec- tion and censoring, 2022. URL https://github. com/notAI- tech/NudeNet. 2

    work page 2022

Show all 52 references
  1. [9]

    Multimodal datasets: misogyny, pornography, and ma- lignant stereotypes

    Abeba Birhane, Vinay Uday Prabhu, and Emmanuel Kahem- bwe. Multimodal datasets: misogyny, pornography, and ma- lignant stereotypes. arXiv preprint arXiv:2110.01963, 2021. 2

    2021 arXiv

  2. [10]

    Extracting training data from diffu- sion models

    Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagiel- ski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ip- polito, and Eric Wallace. Extracting training data from diffu- sion models. In 32nd USENIX Security Symposium (USENIX Security 23), pages 5253–5270, 2023. 2

    2023

  3. [11]

    Diffusion models beat gans on image synthesis

    Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neural informa- tion processing systems, 34:8780–8794, 2021. 2

    2021

  4. [12]

    Erasing concepts from diffusion models

    Rohit Gandikota, Joanna Materzynska, Jaden Fiotto- Kaufman, and David Bau. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 2426–2436, 2023. 2, 3, 6

    2023

  5. [13]

    Unified concept editing in diffusion models

    Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzy´nska, and David Bau. Unified concept editing in diffusion models. In Proceedings of the IEEE/CVF Win- ter Conference on Applications of Computer Vision , pages 5111–5120, 2024. 3

    2024

  6. [14]

    Selective amnesia: A contin- ual learning approach to forgetting in deep generative mod- els

    Alvin Heng and Harold Soh. Selective amnesia: A contin- ual learning approach to forgetting in deep generative mod- els. Advances in Neural Information Processing Systems, 36,

  7. [15]

    Prompt-to-prompt image editing with cross-attention control

    Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yael Pritch, and Daniel Cohen-or. Prompt-to-prompt image editing with cross-attention control. In The Eleventh Inter- national Conference on Learning Representations. 3

  8. [16]

    Gans trained by a two time-scale update rule converge to a local nash equilib- rium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilib- rium. Advances in neural information processing systems , 30, 2017. 6

    2017

  9. [17]

    Classifier-free diffusion guidance

    Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. In NeurIPS 2021 Workshop on Deep Generative Models and Downstream Applications. 2, 3, 6

    2021

  10. [18]

    Denoising dif- fusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising dif- fusion probabilistic models. Advances in neural information processing systems, 33:6840–6851, 2020. 2

    2020

  11. [19]

    Auto-encoding variational bayes

    Diederik P Kingma. Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114, 2013. 3

    2013 arXiv

  12. [20]

    Ablating con- cepts in text-to-image diffusion models

    Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating con- cepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 22691–22702, 2023. 2, 3, 6

    2023

  13. [21]

    Deep nn for nsfw detection

    Gant Laborde. Deep nn for nsfw detection. 2

  14. [22]

    Improving synthetic image detection to- wards generalization: An image transformation perspective

    Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang, Yao Hu, and Fuli Feng. Improving synthetic image detection to- wards generalization: An image transformation perspective. arXiv preprint arXiv:2408.06741, 2024. 2

    2024 arXiv

  15. [23]

    Model inversion attacks through target-specific conditional diffusion models

    Ouxiang Li, Yanbin Hao, Zhicai Wang, Bin Zhu, Shuo Wang, Zaixi Zhang, and Fuli Feng. Model inversion attacks through target-specific conditional diffusion models. arXiv preprint arXiv:2407.11424, 2024. 2

    2024 arXiv

  16. [24]

    Get what you want, not what you don’t: Image content suppression for text-to-image diffusion mod- els

    Senmao Li, Joost van de Weijer, Fahad Khan, Qibin Hou, Yaxing Wang, et al. Get what you want, not what you don’t: Image content suppression for text-to-image diffusion mod- els. In The Twelfth International Conference on Learning Representations. 2, 3, 6, 21

  17. [25]

    Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps

    Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. Advances in Neural Information Processing Systems , 35:5775–5787,

  18. [26]

    Mace: Mass concept erasure in diffu- sion models

    Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. Mace: Mass concept erasure in diffu- sion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 6430– 6440, 2024. 2, 3, 6

    2024

  19. [27]

    One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications

    Mengyao Lyu, Yuhong Yang, Haiwen Hong, Hui Chen, Xuan Jin, Yuan He, Hui Xue, Jungong Han, and Guiguang Ding. One-dimensional adapter to rule them all: Concepts diffusion models and erasing applications. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern R...

    2024

  20. [28]

    Locating and editing factual associations in gpt

    Kevin Meng, David Bau, Alex Andonian, and Yonatan Be- linkov. Locating and editing factual associations in gpt. Advances in Neural Information Processing Systems , 35: 17359–17372, 2022. 4

    2022

  21. [29]

    Matrix analysis and applied linear algebra

    Carl D Meyer. Matrix analysis and applied linear algebra . SIAM, 2023. 11

    2023

  22. [30]

    Improved denoising diffusion probabilistic models

    Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. In International conference on machine learning, pages 8162–8171. PMLR,

  23. [31]

    Sdxl: Improving latent diffusion models for high-resolution image synthesis

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas M ¨uller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. In The Twelfth Interna- tional Conference on Learning Representations. 1, 17

  24. [32]

    Controlling text-to-image diffusion by orthogo- nal finetuning

    Zeju Qiu, Weiyang Liu, Haiwen Feng, Yuxuan Xue, Yao Feng, Zhen Liu, Dan Zhang, Adrian Weller, and Bernhard Sch¨olkopf. Controlling text-to-image diffusion by orthogo- nal finetuning. Advances in Neural Information Processing Systems, 36:79320–79362, 2023. 5

    2023

  25. [33]

    Learning transferable visual models from natural language supervi- sion

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervi- sion. In International conference on machine learning, ...

    2021

  26. [34]

    Exploring the limits of transfer learning with a unified text-to-text transformer

    Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning research, 21(140):1–67, 2020. 18

    2020

  27. [35]

    Red-teaming the stable diffusion safety filter

    Javier Rando, Daniel Paleka, David Lindner, Lennart Heim, and Florian Tram`er. Red-teaming the stable diffusion safety filter. arXiv preprint arXiv:2210.04610, 2022. 3

    2022 arXiv

  28. [36]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 2, 3

    2022

  29. [37]

    U- net: Convolutional networks for biomedical image segmen- tation

    Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U- net: Convolutional networks for biomedical image segmen- tation. In Medical image computing and computer-assisted intervention–MICCAI 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings, pa...

    2015

  30. [38]

    Patrick Schramowski, Christopher Tauchmann, and Kristian Kersting. Can machines help us answering question 16 in datasheets, and in turn reflecting on inappropriate content? In Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency, pages 1350–136...

    2022

  31. [39]

    Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models

    Patrick Schramowski, Manuel Brack, Bj ¨orn Deiseroth, and Kristian Kersting. Safe latent diffusion: Mitigating inappro- priate degeneration in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22522–22531, 2023. 1, 2, 3, 6

    2023

  32. [40]

    Laion- 400m: Open dataset of clip-filtered 400 million image-text pairs

    Christoph Schuhmann, Robert Kaczmarczyk, Aran Komat- suzaki, Aarush Katta, Richard Vencu, Romain Beaumont, Jenia Jitsev, Theo Coombes, and Clayton Mullis. Laion- 400m: Open dataset of clip-filtered 400 million image-text pairs. In NeurIPS Workshop Datacentric AI , number FZJ- ...

    2022

  33. [41]

    Laion-5b: An open large-scale dataset for training next generation image-text models

    Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Worts- man, et al. Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in Neural In- f...

    2022

  34. [42]

    Glaze: Protecting artists from style mimicry by {Text-to-Image} models

    Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by {Text-to-Image} models. In 32nd USENIX Security Symposium (USENIX Security 23) , pages 2187–2204, 2023. 2

    2023

  35. [43]

    Im- proving image captioning with better use of captions

    Zhan Shi, Xu Zhou, Xipeng Qiu, and Xiaodan Zhu. Im- proving image captioning with better use of captions. arXiv preprint arXiv:2006.11807, 2020. 2, 3

    2006 arXiv

  36. [44]

    Diffusion art or digital forgery? investigating data replication in diffusion models

    Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6048–6058, 2023. 2

    2023

  37. [45]

    Key-locked rank one editing for text-to-image personaliza- tion

    Yoad Tewel, Rinon Gal, Gal Chechik, and Yuval Atzmon. Key-locked rank one editing for text-to-image personaliza- tion. In ACM SIGGRAPH 2023 Conference Proceedings , pages 1–11, 2023. 3

    2023

  38. [46]

    Ring-a-bell! how reliable are concept removal methods for diffusion models? In The Twelfth International Conference on Learning Representations

    Yu-Lin Tsai, Chia-Yi Hsu, Chulin Xie, Chih-Hsun Lin, Jia You Chen, Bo Li, Pin-Yu Chen, Chia-Mu Yu, and Chun- Ying Huang. Ring-a-bell! how reliable are concept removal methods for diffusion models? In The Twelfth International Conference on Learning Representations. 3

  39. [47]

    Attention is all you need

    A Vaswani. Attention is all you need. Advances in Neural Information Processing Systems, 2017. 3

    2017

  40. [48]

    Erasediff: Erasing data influence in diffusion models

    Jing Wu, Trung Le, Munawar Hayat, and Mehrtash Harandi. Erasediff: Erasing data influence in diffusion models. arXiv preprint arXiv:2401.05779, 2024. 3

    2024 arXiv

  41. [49]

    Mma-diffusion: Multimodal attack on diffusion models

    Yijun Yang, Ruiyuan Gao, Xiaosen Wang, Tsung-Yi Ho, Nan Xu, and Qiang Xu. Mma-diffusion: Multimodal attack on diffusion models. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 7737–7746, 2024. 3

    2024

  42. [50]

    Ip- adapter: Text compatible image prompt adapter for text-to- image diffusion models

    Hu Ye, Jun Zhang, Sibo Liu, Xiao Han, and Wei Yang. Ip- adapter: Text compatible image prompt adapter for text-to- image diffusion models. arXiv preprint arXiv:2308.06721,

    arXiv

  43. [51]

    Safree: Training-free and adaptive guard for safe text-to-image and video generation

    Jaehong Yoon, Shoubin Yu, Vaidehi Patil, Huaxiu Yao, and Mohit Bansal. Safree: Training-free and adaptive guard for safe text-to-image and video generation. In The Thirteenth International Conference on Learning Representations . 3, 20

  44. [52]

    Mickey” exhibits a relatively large cosine similarity of 0.65 with the target concept “Snoopy

    Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 3836–3847, 2023. 2 A. Extra Preliminary on CA Layers The cross-attention (CA) layers in ...

    2023

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.